The Birthlink Case: Lessons in Data Compliance for Every Organisation

In July 2025, the Information Commissioner's Office fined Scottish charity Birthlink £18,000 for the unlawful destruction of approximately 4,800 personal records. Some of those records such as handwritten letters from birth parents, photographs and original birth certificates were irreplaceable. The case has been widely discussed in the charity sector. What makes it worth examining closely is not the fine itself, but the circumstances that led to it because the circumstances are not unusual, they are in fact extremely common.

What Happened

Birthlink maintains the Adoption Contact Register for Scotland, a service that helps adopted individuals and birth families reconnect. Since 1984, it has held deeply sensitive records about thousands of people. In early 2021, the charity faced a practical problem: it was running out of space in the filing cabinets where certain records were stored. The board met and agreed that records relating to completed cases could be destroyed. The decision was not unreasonable on its face value but what followed it was.

Due to the absence of any meaningful records management policy, untrained staff were left to determine which records were replaceable and which were not. Bags of paperwork were destroyed without a proper inventory. Concerns were raised at the time, some staff noticed photographs and handwritten letters being shredded but the destruction continued. It was not until two years later, following an inspection by the Care Inspectorate, that the board became aware that irreplaceable materials had been destroyed.

By the time the ICO investigated, Birthlink could not identify who had been affected. It could not confirm what had been destroyed and the true extent of the loss, the ICO concluded, would never fully be known.

What the ICO Found

The ICO's enforcement notice identified several specific failures:

• Limited understanding of data protection obligations at board level. The trustees who approved the destruction did not understand what they were approving in data protection terms.

• No relevant policies or procedures. The ICO commented that "cost-effective and easy-to-implement policies and procedures" would likely have prevented the destruction entirely.

• No staff training. The people who carried out the destruction had not been trained in data protection or records management.

• A failure to investigate concerns. Despite staff raising concerns at the time, no investigation was conducted and the destruction continued.

• Poor record-keeping. Without a record of processing activities, Birthlink could not confirm what had been destroyed or notify affected individuals.

The ICO initially proposed a fine of £45,000 which was reduced to £18,000 after considering Birthlink's financial position and the remedial steps it had taken including appointing a data protection officer and digitising its remaining records.

Why This Case Matters

To be clear, Birthlink works in an unusually sensitive area, the records it holds are deeply personal, and their loss has consequences that extend decades into the future, but the governance failures the ICO identified are not sector-specific; they are found across not for profit organisations of all sizes and types, and the implications could impact you directly and personally if you recognise any of these in your governance structures:

• Boards that approve decisions without understanding the data protection implications.

• Organisations that process personal data without documented policies.

• Staff who handle sensitive information without training.

• Charities that cannot respond to a breach because they have no record of what they hold.

The ICO's head of investigations said: "It is inconceivable to think, due to the very nature of its work, that Birthlink had such a poor understanding of both its data protection responsibilities and records management process." but the inconceivable is, in practice, common.

Three Lessons for Every NFP Board

1. Board decisions have data protection consequences

The Birthlink board did not set out to cause harm, they made what seemed like a reasonable operational decision. The problem was that they made it without the information needed to make it safely; specifically, without understanding what the records contained, what legal obligations attached to them, and what a compliant destruction process would look like. Data protection literacy at board level is not a nice-to-have, it is what makes governance meaningful.

2. Policies prevent harm and they need not be expensive

The ICO's comment that basic policies would likely have prevented the breach is significant. It is not saying that Birthlink needed a sophisticated compliance programme, but it is saying that a clear records management policy would have been enough to prevent an irreversible loss. The absence of documentation is not neutral, it is a risk.

3. You cannot report what you do not know

One of the most damaging aspects of the Birthlink case was the charity's inability to notify affected individuals. As it had no record of processing activities, it could not identify who had been affected and this is why a Record of Processing Activities matters practically, not just as a regulatory requirement because when something goes wrong, it is the document that tells you what you need to do next.

What to Do With This

The Birthlink case is not a cautionary tale about a rogue organisation, it should be viewed as a mirror. Most NFP boards, if they look at the ICO's findings honestly, will recognise at least some of them in their own organisation.

The question worth asking after reading this is not "could this happen to us?" It is "what would the ICO find if it looked at our data governance today?" If the honest answer involves uncertainty, that uncertainty is worth addressing before something forces the question.